The present invention relates to the field of event management systems, in particular to dynamic correlation of events.
Information technology (IT) has evolved from mainframe-only computing to complex, highly distributed computer systems spanning across desktops and departments through networks. These distributed computing environments provide benefits, including the flexibility to select any number of platforms, domains, tools, and network configurations. The distributed environments, however, may be complex. Further, there may exist a lack of compatibility and integration between software tools and platforms. For example, conventional point products (e.g., the Platinum DBVision product manufactured by Platinum technology, inc. of Oakbrook Terrace, Ill.) are generally directed to a specific function or area of expertise such as a solution for database monitoring and management, job scheduling, or managing database reorganizations. Each point product provides a specific capability and each also includes a distinct interface. On the other hand, utilizing framework technology provides an integrated solution, although tool functionality is significantly sacrificed. Further, maintaining the current enterprise environment utilizing either conventional point products or framework technology involves a large amount of resources and money from IT organizations.
Accordingly, a need exists for an integrated system for providing tools that utilize a compatible interface without significantly sacrificing tool functionality.
An object of the present invention is providing an integrated system for monitoring events occurring in point products through a common event management system.
Another object of the present invention is the dynamic correlation of events across nodes of an enterprise.
It is still another object of the present invention to dynamically execute a changed rule and/or a newly added rule for event correlation.
An aspect of the present invention provides an event management system including an event manager, an alarm rule store, an event correlator, and a response engine. The event manager receives and distributes event information. The event correlator correlates event information provided by an event manager based on alarm rules which are stored in an alarm rule store. The response engine executes a response policy based on the correlation of events by the event correlator.
Another aspect of the present invention provides a method for dynamically executing a modified rule or a new rule for event correlation. The method further includes comparing a first rule set to a second rule set to identify modifications, additions, or deletions of rules and dynamically executing all of the respective rules that have been modified or added.